kleinburd.ru
Open in
urlscan Pro
95.211.16.75
Malicious Activity!
Public Scan
Submitted URL: http://www.proactivegenomics.com/wp-includes/js/jcrop/r/
Effective URL: https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/login.php
Submission: On May 13 via api from US
Effective URL: https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/login.php
Submission: On May 13 via api from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 25 HTTP transactions.
The main IP is 95.211.16.75, located in
Delft, Netherlands and
belongs to LEASEWEB-NL-AMS-01 Netherlands, NL.
The main domain is kleinburd.ru.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 11th 2019. Valid for: 3 months.
This is the only time kleinburd.ru was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 11th 2019. Valid for: 3 months.
This is the only time kleinburd.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2606:4700:30:... 2606:4700:30::681c:fde | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 1 25 | 95.211.16.75 95.211.16.75 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
| 25 | 2 |
1
2606:4700:30::681c:fde
(United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| www.proactivegenomics.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 25 |
kleinburd.ru
1 redirects
kleinburd.ru |
178 KB |
| 1 |
proactivegenomics.com
www.proactivegenomics.com |
646 B |
| 25 | 2 |
| Domain | Requested by | |
|---|---|---|
| 25 | kleinburd.ru |
1 redirects
kleinburd.ru
|
| 1 | www.proactivegenomics.com | |
| 25 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| kleinburd.ru cPanel, Inc. Certification Authority |
2019-03-11 - 2019-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/login.php
Frame ID: 47A476FC8198F0EB6224666FD8A6915F
Requests: 25 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://www.proactivegenomics.com/wp-includes/js/jcrop/r/ Page URL
-
https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/
HTTP 302
https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/login.php Page URL
Detected technologies
CloudFlare
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /cloudflare/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.proactivegenomics.com/wp-includes/js/jcrop/r/ Page URL
-
https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/
HTTP 302
https://kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
 Cookie set
/
www.proactivegenomics.com/wp-includes/js/jcrop/r/ |
126 B 646 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
login.php
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/ Redirect Chain
|
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cck.js
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
432 B 555 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
vl.js
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
10 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
reset.css
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
607 B 673 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_template-styles.css
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
20 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_ibRedesign-styles.css
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo_nab.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
button.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b4nn3r.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
102 KB 102 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
NAB_Defence.gif
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gr_arrow-1.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg_banner-2.jpg
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg_input_user.gif
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/images/login/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ico_sprite.gif
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gr_bg_btn01.gif
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
gr_dot-1.gif
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/images/login/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-icon-facebook.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-icon-twitter.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-icon-gplus.gif
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
footer-icon-youtube.png
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/updatenab/filles/ |
148 B 148 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
corpid-l-webfont.woff
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/webfonts/ |
148 B 354 B |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
corpid-b-webfont.woff
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/webfonts/ |
148 B 354 B |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
corpid-l-webfont.ttf
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/webfonts/ |
148 B 354 B |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
corpid-b-webfont.ttf
kleinburd.ru/shop/admin301dm6zws/autoupgrade/verifyyouraccount/webfonts/ |
148 B 355 B |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask string| message function| clickIE function| clickNS function| Validator function| set_addnl_vfunction function| clear_all_validations function| form_submit_handler function| add_validation function| ValidationDesc function| vdesc_validate function| ValidationSet function| add_validationdesc function| vset_validate function| validateEmailv2 function| V2validateData object| d object| weekday object| months object| current_date number| month_value number| day_value number| year_value object| frmvalidator0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
kleinburd.ru
www.proactivegenomics.com
2606:4700:30::681c:fde
95.211.16.75
1e61ffdfeb77f256dee30dd9b345b360df85c67bace0dc5092ee0afdc44d3e05
23d1ffde970514024a2b3994a5508d96e357c3b27b1c073086138f7ffc84a891
52a4cc3647e993c9a3c41dbbbca24adda159c3704411fece1ebe828badd48079
53090c09e2fd90f7ae4f88fdcf5295b5c72258ae08bcd26e07724accb57f9cbd
7edf6e3f957185192d8ccc80f8d018159377c9010b0a9739d992d83d6ecf0354
9b52e2fc66c284c625e4a36d1129bce581dbf3aa03dd6fde41bcadd7ffbd8993
9d5ff6dcd6c6d828f05f2530d1da29bf75d142b28a37c0435c742c708765a151
a8713a131510b9078b735d4925f6ec092c040cb27d13f80ff8f5d997fc8b1b6f
c4d9a3125d8ae44072e64b39bacde45a74d6157c5d8b7e965b9a919739338e84
c8b5c36b604b175f0c6be6b98f40c5b82c05b0a76aadd383a61b0f4fe0b3d264
ce01691bc9c3e2e199ae1ba0fa3b33d0df34e201e76f4a7193efc9169b7deab3
ce23e6c040f41bfc9178cf1883d526890529dad5a577ea2aef803520ce83a4f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855